Performance and flow analysis method for communication networks

ABSTRACT

A system and method are used for visually representing performance and flow analysis of a communication network having devices connected by links. The system includes a first memory for storing a graphical representation of the communication network and showing the devices connected by links and a second memory storing data representing performance and flows in the communication network. A processing system is operatively connected to the first and the second memory and to a display. The processing system selectively maps the data on the graphical representation of the communication network by varying visual characteristics of the devices and the links for viewing on the display.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims priority of application Ser. No. 60/275,613,filed Mar. 14, 2001, and upon application Ser. no. 09/923,567, filedAug. 7, 2001.

BACKGROUND OF THE INVENTION

Communication networks are increasingly becoming critical resources.In-depth understanding of the communication networks' behavior and whatthe physical and application flows that are crossing network devices isimperative in order for the communication networks to provide goodquality of service to network service customers.

A communication network may consist, in part, of an enterprise network.An enterprise network typically includes geographically disperseddevices under the control of a particular organization. It may consistof different types of networks operating together as well as differentcomputer systems. As such enterprise networks are getting larger andmore complex, analyzing the performance or flows of these networks is achallenging task. This is due, in part, to the substantial amount ofdata an operator must review for such an analysis.

The present invention is directed to improvements in and analyzingperformance and flow for communication networks.

SUMMARY OF THE INVENTION

The present invention relates to a method and system of analyzingcollected performance and flow information for networks.

In accordance with one aspect of the invention there is disclosed asystem and method for visually representing performance and flowanalysis of a communication network having devices connected by links.The system includes a first memory for storing a graphicalrepresentation of the communication network and showing the devicesconnected by links and a second memory storing data representingperformance and flows in the communication network. A processing systemis operatively connected to the first and the second memory and to adisplay. The processing system selectively maps the data on thegraphical representation of the communication network by varying visualcharacteristics of the devices and the links for viewing on the display.

In accordance with another aspect of the invention a system and methodis provided for mapping performance and flow analysis of a communicationnetwork having devices connected by links. The system includes a firstmemory for storing a graphical representation of the communicationnetwork and showing the devices connected by links. A second memorystores data representing performance and flows in the communicationnetwork. A third memory stores a plurality of symbols representingdifferent devices and a plurality of edges representing links.Processing means selectively map the data on the graphicalrepresentation of the communication network by varying visualcharacteristics of the symbols and the edges responsive to theperformance and flows in the communication network to build a graphicaldisplay

Further aspects and advantages of the invention will be readily apparentfrom the specification and from the drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a system for performing performance andflow analysis for a network;

FIG. 2 is a graphical representation of how network elements are definedin a network topology;

FIG. 3 is a graphical representation of how the network elements of FIG.2 are illustrated in a display system in accordance with the invention;

FIG. 4 is a graphical representation of a network topology;

FIG. 5 illustrates a display generated in accordance with the inventionfor illustrating performance and flow for the topology of FIG. 4;

FIGS. 6-9 illustrate mapping techniques for representing metrics fordifferent types of information in accordance with the invention;

FIG. 10 is a graphical representation, similar to FIG. 3, representingbidirectional flows between two devices;

FIG. 11 is an exemplary display of bidirectional flows between twodevices;

FIG. 12 is a graphical representation of a network topology for a viewusage case in accordance with the invention;

FIG. 13 is an illustration of a display for the topology of FIG. 12 forillustrating a flow/volume view usage case;

FIG. 14 is an illustration of a display for the topology of FIG. 12 forillustrating a flow/congestion view usage case;

FIG. 15 is a generalized representation of a database for storingtopology and statistical information used in the method and system ofthe present invention;

FIG. 16 is a flow diagram illustrating collection and storage of datafor building the database of FIG. 15;

FIG. 17 is a flow diagram illustrating a visualization program algorithmin accordance with the invention;

FIG. 18 is a graphical representation of a portion of the topology forillustrating operation of the visualization program of FIG. 17; and

FIG. 19 is a display generated by the visualization program of FIG. 17using the topology of FIG. 18.

DETAILED DESCRIPTION OF THE INVENTION

Referring initially to FIG. 1, a performance and flow analysis system 20operates in connection with a communication network 22. Thecommunication network 22 carries information between remote sites orcomputers. The information may consist of voice, video, files,electronic mail, etc. In the illustrated embodiment of the invention,the network 22 comprises a “packet” or “connectionless” communicationmodel. The system 20 is intended to manage enterprise networks. However,it is also suitable for management service provides (MSPs) that manage acustomer's networks.

The present invention relates particularly to “visualization” softwareoperating in the network management system 20 for the visualization ofpeformance and data flows on the communication network 22. In theillustrated embodiment of the invention, the network management system20 includes a dedicated management network 24 for gathering informationfrom the communication network 22. A server 26 is connected to themanagement network 24. The server 26 operates in accordance with thevisualization software, discussed above, A memory 28 and display 30 areoperatively connected to the server 26. The memory 28 may consist of anytype of memory, including ROM memory, RAM memory, fixed disk drives andremovable disk drives, and the like. The memory 28 stores thevisualization software and the collected information in the form of adatabase, as described below. As is apparent, the memory 28 may includeplural discrete memory devices. Also, individual memory devices can beconsidered as equivalent to separate memory devices relative to thespecific data stored therein.

As will be apparent, the management network 24 may take any known formand the server 26 may be an integral component of the management network24. However, the server 26 is not intended to be a node in thecommunication network 22 as it hosts the visualization software formanagement purposes only.

The visualization software enables monitoring of information flows inreal time or deferred time. Visualization of traffic is enabled over aspecific time span to quickly pinpoint and understand cause of problemswhich may arrive periodically, such as, for example, bottlenecks,application slowdowns, etc. As such, the visualization software providescomplete visibility of the flows and the evolution of the flows. This isdone using physical mapping of the network for visualizing andunderstanding the complex exchange patterns between applications andusers.

Referring to FIG. 2, network devices A and B can be graphicallyrepresented as nodes 32. Network interfaces 34 associated with each node32 are interconnected via a link 36. Network devices 32 can generally beclassified as infrastructure devices, such as routers or switches, orthe like, which are used for forwarding packets. The network devices 32may also include terminal (LEAF) devices, such as servers, personalcomputers (PCs), work stations, printers, etc., that provide informationto or consume information from other devices. The links 36 are mainlycharacterized by their technology, such as Ethernet, ATM, etc., andtheir transmission speed which is usually represented in bits/second.The links 36 link network devices 32 through the network interfaces 34with one network interface 34 on each side of the link 36. In accordancewith the invention, the network management system 20 displays thenetwork elements shown in FIG. 2 in the form illustrated in FIG. 3.Particularly, the device nodes 32 are shown connected via a graph edge38. The edge 38, which also may be referred to as an “arc”, is the chartof a link 36 which interconnects two network node devices. Thus, a link36 is an object of the network, which is graphically displayed by anedge 38. The network interfaces 34 are hidden on the visual display.

Packet networks divide information into several smaller packets. Thesepackets are then handled independently by network devices. The InternetProtocol (IP) communication protocol is a typical packet-orientedprotocol. The network 22 in FIG. 1 is made up of a large number ofinfrastructure devices, such as switches or routers, that forward eachpacket in a required direction depending on a final delivery address.The success of a network is its ability to handle large amounts ofinformation and to connect together virtually unlimited numbers ofusers. Network performance management in accordance with the inventionis based on the periodical collection of local metrics or on trafficsimulation. The metrics are related to a specific device or interface.

For effective network management, it is necessary to choose a set ofmetrics that will characterize the network's ability to transmit theflow of information that is submitted to it and qualify the type oftraffic (for example per protocol or per application, and per directionof traffic). Examples of the most frequently used metrics forperformance and flow analysis include;

-   -   input and output throughput of device interfaces, information        loss rate per device and per interface, overrunning of internal        device resources (processors, memories, queues . . . ), etc,    -   Per Network protocol throughput (IP/IPX/ . . . ), Per        Application protocol throughput (HTTP/SMTP/NNTP/SAP/Oracle . . .        ), etc.

The analysis of performance and flows require the processing of largeamounts of collected data samples. Several hundred samples up to severalhundreds of thousands of samples only represent an instantaneoussnapshot of a network state, depending on the size of the network, andon its complexity. Furthermore, having a history of several sampleperiods is necessary to illustrate the dynamic nature of a network, andof its evolution. The present invention provides a specific andefficient presentation of the information in order to understand thecomplex system that the communication network represents.

The network management system 20, using samples of information, makes asnapshot of the network 22 and maps user-chosen metric values on agraphic representation of the physical network topology. Device-relatedmetrics are mapped over the graph device nodes 32 whileinterface-related metrics are mapped over the graph edges 38. Inaccordance with the invention, the network management system 20 uses agraphic representation of topology of the network 22, techniques forrepresenting metrics over the graph element, referred to herein as“mappings”, automatic association methods between metrics and mappings,and an ergonomic and efficient presentation system, referred to hereinas “views”, that display only a subset of all available metrics.

Referring to FIG. 4, a classical graphical representation of thetopology of a network 100 is illustrated. The network 100 includes twoinfrastructure devices in the form of switches 102 and 104 connected toLEAF devices in the form of PCs 105-112. Node devices are represented bysymbols. Different symbols are drawn depending on the device type and onthe services the device provides. These services may include routingservices, switching services, VLAN (Virtual Local Area Network) service,etc. In order to be compared, the node devices occupy approximately thesame area on a visual display. Links are represented as connectionsbetween devices. An example is the line 114 between the PC 107 and theswitch 102. The links have speeds that can vary from several kilobitsper second to gigabits per second. The size of the link reflects thenominal speed of the link in the classical representation. Particularly,the thicker the line, the faster the link.

The present invention provides dynamic visual representation of anetwork. This is done to represent network load along with networkresources used. To do so, it is necessary to choose a few metrics out ofthe set of available metrics. These metrics may include, for example,the device load (number of packets per second handled by the device),the link throughput (bits per second) for each direction, and the linkload (for example, a percentile of its nominal throughput). FIG. 5illustrates mapping of the metrics in accordance with the invention fora network having a topology as shown in FIG. 4. As is apparent, the nodedevices 102 and 104 have different sizes when compared to therepresentation of FIG. 4, and the links are displayed as bidirectionalarrows. Particularly, the size of each infrastructure element depends onthe number of packets that go through the element. In the illustrationof FIG. 5, the switch 104 carries more packets than the switch 102resulting in the larger size. Bidirectional arrows have a differentthickness and a different contact point. The thickness and contactpoints depend on the throughput of each direction. In the illustrationof FIG. 5, it is apparent that there is a large flow of informationgoing from the PC 107 through the switch 102 and then to the PC 108.This traffic is far greater than the traffic involving the other PCs105, 106 and 109-112. The color of the link also depends on the linkutilization rate. In the illustration of FIG. 5 this is represented bythe darker color for the transfer from the PC 107 to the PC 108 as itrequires more link resources than all the other links in FIG. 5.

The mappings, i.e., techniques for representing metrics, are used tographically represent different types of information. The mappings allowa user to visually and quickly evaluate a metric (for example, see at aglance that a device load is near the device saturation) and compareseveral metrics of the same type (for example all the throughput on anetwork). The following describes several mappings that could be used.As is apparent, not all possible mappings are described herein.

Symbol size variation can be used for mapping symbols for node devicesas illustrated in FIG. 6. Particularly, the size of the symbol can varyfrom a smaller size, as shown to the left of the arrow, and be increasedto a larger size, as shown to the right of the arrow. The higher themetric value, the larger the size of the node on the screen. Similarly,symbol color variation can be used by applying a color transparencylevel on the symbol. The higher the metric value, the higher the colorlevel. A combination of this kind of mapping can be used with othermappings such as symbol size.

FIGS. 7-9 illustrate mapping symbols for links. Particularly, FIG. 7illustrates link thickness variation. The higher the metric value, thethicker the link. FIG. 8 illustrates bidirectional thickness variation.This mapping simultaneously represents two metrics of the same type. Thehigher the metric value, the larger the associated arrow. Also, thecontact point of the arrows changes according to the relative metricvalues in the two directions. FIG. 9 illustrates link layer thicknessvariation. This mapping represents simultaneously several metrics of thesame type. The higher the metric value, the thicker the associatedlayer. Line color variation or bidirectional color variation may also beused with mapping symbols for links. This is done by applying a colortransparency on the link. The higher the metric value, the higher thecolor level on the link or on the associated arrow.

In the illustrated embodiment of the invention, several mappings aregeneral purpose mappings as they can be used very frequently and appliedto a large number of metrics. These include size variation, thicknessvariation and color variation which are well suited for thevisualization of the metrics such as load, volumes and rates, or thelike. For example, the CPU load of a device, a link throughput, theutilization rate of a device or of a link, or the collision rate of anEthernet link. Other mappings better fit other situations. For example,bidirectional arrows are well suited for oriented metrics. For example,flows going into or out of a device, errors detected on incomingpackets, or errors detected on outgoing packets. Color layers are wellsuited for distribution of homogeneous metrics. For example,visualization of traffic on a link, per communication protocol, perapplication or per VLAN, or distribution of the traffic on a link percomputer contributing to this traffic.

In order to provide a complete visualization technique, it is necessaryto handle special situations. These include:

Representation of an “in range” value: a value greater or equal to aminimum value and, lower or equal to a maximum value (These values mustbe user definable). Representation of a value lower than the minimumvalue (out of range value). Representation of a value greater than themaximum value (out of range value). Representation of a missing value.This is a very frequent situation, often due to an unreachable or out oforder device due to network or instrumentation problems.

For the first case (in range value) the “mapping” must representlinearly the metric value.

For the other cases, this can be qualified as “remarkable”, the mappingmust define for each situation a representation that allows todistinguish very easily this special value from an “in range” value.

The following table shows the various representations for each situationof the Mappings described above:

Missing Value < [min >= Value > Mapping value minimum value <= max]maximum Symbol Dashed Very Symbol size “Exploded” size corners smalllinearly Symbol symbol modified. Symbol Transparent User Color Usercolor defined transparency defined color level applied color linearlyLink Standard Thickness Thickness Maximum thickness thickness set to 1linearly thickness + Dashed line pixel modified Dashed borders LinkTransparent User Color User color defined transparency defined colorlevel applied color linearly Bi-di- Standard Thickness Thickness Maximumrectional thickness set to 1 linearly thickness + arrow Dashed pixelmodified Dashed thickness arrow borders

The symbols and edges used in the mapping technique are stored in thememory 28. When metrics are selected to build a display the appropriatesymbols or edges are selected from the memory in accordance with themetrics to be analyzed, as will be apparent.

For association methods between metrics and mappings, metrics can becollected in various manners. Among these are real time counters pollingfrom the devices, information pushed from devices or to the system, or aquery from a database, the database being fed by a collection process.Metrics are always associated with instrumented objects. An instrumentedobject is an object able to provide measurements. Network devices andnetwork device interfaces are objects which can be instrumented. Often,a link is not an object which can be instrumented. Therefore, a metricis often not directly associated with a link. FIG. 2, discussed above,shows the real elements involved in a connection between devices. Thepresentation system representation is shown in FIG. 3. In order tofacilitate presentation of metrics on an edge, the presentationtechnique herein defines rules that will associate these metrics with anedge:

-   -   that are directly related to the edge when direct edge metrics        are available, or    -   that are not directly related to the edge when direct edge        metrics are not available, and relevant metrics are available        elsewhere.

The visualization software includes a metric/mapping association system.This system is in charge of finding all relevant metrics for each typeof presented objects (nodes/edge) from the set of all available metrics.The system also applies rules to select the best metric when severalchoices are available. In certain cases, most notably edges, the systemhides the metric choice complexity, thus making it seem to the user thatall metrics are directly “collected” from the presented object.

FIG. 10 illustrates an example where metrics are gathered from ends ofthe edge. The available metrics are the input and output throughput foreach device 32. This information comes from the device interfaces 34. Inthe illustration, they are named “A.in”, “A.out”, “B.in” and “B.out”.Normally, A.in provides the same values of B.out, and A.out provides thesame values as B.in. Representing the throughput going from A and B(named “A.O” and “B.O”) can be done in four ways:

A.O=A.out, B.O=B.out (metrics issued from two ends) A.O=A.out, B.O=A.in(metrics issued from only one end: A) A.O=B.in, B.O=B.out (metricsissued from only one end: B) A.O=B.in, B.O=A.in (metrics issued from thetwo ends, but inverted)An example is illustrated in FIG. 11.

In certain cases, metrics are only available at one end of an edge. Thisreduces the number of possible choices. Among others, possible casesinclude only one device being instrumented. In this case, the onlychoice is [A.O=A.out, B.O=A.in], or [A.O=B.in, B.O=B.out] depending onthe instrumented device. Another possible case is that there is amissing metric on one side. For example, B.out is missing. In this case,the number of choices is reduced to two, i.e., [A.O=A.out, B.O=A.in] or[A.O=B.in, B.O=A.in].

The following illustrates an example of representing a number ofEthernet collisions on an edge between two devices. This example relatesto a situation where the metric available on a device interface isrelated to the link, although it is provided by the interface. Thecollision number is a metric that is usually provided by a deviceinterface, but it represents the number of collisions detected on themedia, not on the interface itself. Although this metric is provided bya device interface, it is in fact related to the edge on the graphicrepresentation of the network. The metric/mapping association system hasto associate this interface metric with the edge, or will have tochoose, randomly or arbitrarily, one metric in case this metric isavailable on the two ends.

Every network element, such as a node or an edge, can provide dozens ofmetrics. Physiologically, a person is unable to perceive such a greatamount of information at the same time, for each node and edgerepresenting a network. Assuming a person is able to perceive two tothree different metrics per element type, there are a maximum of sixdifferent metrics for a network representation made of two types ofelements, namely nodes and edges. The visualization software describedherein applies a “view” principle to the presentation and mappingtechniques described. A view is a subset of metrics per element type.This subset is applied to the graph that represents the network and is asubset for nodes, typically up to two, and a subset for edges, typicallyup to three. Each metric is applied to all the elements of the sametype. For example, if the CPU utilization metric is chosen for nodes,then all the nodes will display their CPU utilization metric. The viewprinciple allows the user to focus on one or several aspects of thenetwork. For example, flow analysis, congestion analysis or stateanalysis. Flow analysis considers the kind of traffic, the communicationprotocols used, the applications used and the volumes being transferred.Congestion analysis considers the bottlenecks, the resource usage andcollisions. The state analysis considers which devices or links aredown, the availability of the devices, and the most frequently faultydevices. Alternative types of use might also be used.

FIG. 12 illustrates a network to be analyzed for a flow/volume viewusage case. This view is based on three metrics. Device workload ismapped on device size. The higher number of packets across a device, thelarger the device. Input and output throughput are mapped on edges,represented by bidirectional arrows. The higher the volume in onedirection, the thicker the arrow. The total throughput on edges isrepresented by a color variation. The greater the traffic, the morecolor in the edge. FIG. 12 illustrates the topology for a network 120 tobe analyzed for the flow/volume usage case. FIG. 13 illustrates avisualization display generated using the system 20 of FIG. 1 for thenetwork 120 of FIG. 12 under certain conditions. Particularly, this viewof FIG. 13 shows the current flows between devices and particularlypinpoints the greatest flow which is going from a device 122 to a device124. This flow is through several other devices.

For a flow/congestion view usage case, the view is based on a differentset of metrics. Device workload is mapped on device size. The highernumber of packets across a device, the larger the device. Input andoutput throughput are mapped on edges, represented by bidirectionalarrows. The higher the volume in one direction, the thicker the arrow.The link's usage rate is mapped on edges and represented by a colorvariation. The more congested the link, the more color in the edge.

FIG. 14 illustrates an example of a flow/congestion view usage case forthe network 120. This view gives the user a new vision of thephenomenon. In fact, the link between the central device 126 and thedevice 124 has a higher transfer rate than the others. This means thatalthough the transfer is great, the link is not overloaded. But theother links are near saturation. One can imagine that the transfer rateis limited by the links between the device 122 and the central device126.

Other views such as views expressing the correlation between collisionrate and response time or collision rate and volume, would providevaluable information for understanding the behavior of the network andanalyzing it.

Referring to FIG. 15, a database 40 is represented graphically. Thedatabase 40 is stored in the memory 28 of FIG. 1, as described above.Among the information stored in the database 40 are topologyrepresentations 42 and metric samples in the form of statistics 44.These statistics are illustrated in three-dimensional form as “Ine”(representing instrumented network elements), metrics and time. Asnapshot of these statistics represents a plane cut through thethree-dimensional representation at a given time to illustrate themetrics at that time for all of the Ine's.

Referring to FIG. 16, a flow diagram illustrates a program implementedin the server 26 of FIG. 1 for building the database 40. The programbegins at a block 46 where a network is defined. A network is defined byidentifying the node devices 32 and edges 38 that make up the network toprovide the network topology 42, see FIG. 15. The topology 42 is storedat a block 48. As is apparent, the database 40 may store numerousdifferent network topologies. Thereafter, a decision block 50 determinesif it is necessary to update the database statistics 48. The update isinitiated at the appropriate time based on the techniques being used forcollecting metrics, as discussed above. The program continues to loopabout the block 50 until it is necessary to update the database. When anupdate is to occur, then the Ine's are polled at a block 52, in oneembodiment. The collected metrics are then stored at a block 54 and theprogram returns to the decision block 50. The flow diagram of FIG. 16will vary according to the particular collection process being used, aswill be apparent to those skilled in the art.

Referring to FIG. 17, a flow diagram illustrates operation of thevisualization program for performance and flow analysis for acommunication network. The program begins at a block 60 where the userselects a topology to be analyzed and a part of the topology, ifnecessary. The server 26 accesses the topology from the database 40, seeFIG. 15. At a block 62 the user selects a view. The system 20 uses theview system in order to build a list of all metrics that could fulfillrequirements. Depending on a previous list, and a set of elements thatare instrumented, the system applies the rules defined in themetric/mapping association system, described above, to select the bestavailable metrics. These are the metrics defined by the view oralternative metrics when the ideal metric is not available. At a block64 the user selects the time for analysis. The time may be a specifictime or date or may be an interval of time for analysis. The system 20queries the statistics database 44 at a block 66 to retrieve the metricsamples at the selected time. At a block 68 the system 20 sets scales tobe used. For each type of metric the minimum and maximum values aresearched to set the scales. For each type of metric the highest value ofthe scale is set to the maximum sample value found over the specifiedinterval and the lowest value of the scale is set to the minimum samplevalue found.

Thereafter, a display is built at a block 70. The display is built usingthe selected topology and the mapping techniques for representingmetrics, discussed above. This is done by using the correct mapping andapplying the rules for the particular mapping. The display is thenviewed at a block 72 on the display 30, see FIG. 1.

An example of the operation of the flow diagram of FIG. 17 is nowdescribed with respect to FIGS. 18 and 19. FIG. 18 shows a topologyrepresentation which could be selected at the block 60. In this topologythere are four network devices 74, 75, 76 and 77. These devices areconnected by various links, as shown. At the block 62, the user selectsa view that will display traffic per VLAN. VLANs are logical networksthat share a same physical network. VLANs are identified by numbers inthe range [1 . . . 1024]. A VLAN number is comparable to a link metric.This view specifies the ideal metrics that are required and thealternative metrics that could provide the same information. For eachdevice 74-77 the workload metric (the number of packets across thedevice) is the ideal metric. There is no alternate metric. On each link,the input and output throughput metrics are the ideal metrics.Alternative metrics are described above relative to association methodsbetween metrics and mappings. For each link the VLAN number metric is anideal metric. This metric should be available from any one of the twoends of the link. An alternative metric is the VLAN number metric fromthe opposite end of the link. The system 20 compares the ideal metriclist with what is available from the selected elements that make theselected type topology. Alternate metric choice methods are applied whenideal metrics are not available. The system builds the list of availablemetrics for each network element.

After the user selects the time or interval for analysis, the minimumand maximum values are searched over the specified interval in order toset the scales at the block 68. On this topology, four devices 74-77provide the workload metric. The query gets the following samples (oneper each five minutes between 2 a.m. and 2:30 a.m.):

Device/Date/Value 2:00 AM 2:05 AM 2:10 AM 2:15 AM 2:20 AM 2:25 AM Device74 50 pp/s 200 pp/s  30 pp/s 210 pp/s 25 pp/s 35 pp/s Device 75 20 pp/s 40 pp/s  28 pp/s  30 pp/s 40 pp/s 40 pp/s Device 76 45 pp/s 100 pp/s110 pp/s  40 pp/s 80 pp/s 35 pp/s Device 77 50 pp/s  60 pp/s  40 pp/s 35 pp/s 25 pp/s 10 pp/s

The lowest value of the scale for the workload type of metric is set to10 pp/s per second, as determined by device 77 at 2:25 a.m. The highestvalue of the scale is set to 210 pp/s per second, as determined by thedevice 74 at 2:15 a.m. The same processes are run for the input andoutput throughput and VLAN number metrics.

Thereafter, the view system is used to get from the view how torepresent the metrics. This view specifies to represent the workloadmetric as a node size variation, the input and output throughput metricas bidirectional arrows with variable thickness, and the VLAN numbermetric as link color, one color per VLAN number. The mapping rules areapplied to represent sample values according to the specified mappingsas illustrated in FIG. 19. Particularly, FIG. 19 illustrates the resultsat 2:15 a.m. The Device 74 has the highest workload (210 pp/s) and theother devices 75, 76, 77 have a similar and rather low relative workload(30, 40 and 35 pp/s). One can visually see in FIG. 19 that Device 74 isthe most used device on this network and that the other devices have asimilar load relative to one another. The links are colored according totheir VLAN number. Each distinct VLAN is assigned a different color. Inthe illustrated embodiment of the invention, five different VLANs crossthe Device 74 and are helpful in analyzing the traffic distribution perVLAN. Bidirectional arrow thickness represents the input and outputthroughput for each link. The thicker the arrow, the greater the trafficin that direction.

The present invention has been described with respect to flowcharts andblock diagrams. It will be understood that each block of the flowchartand block diagrams can be implemented by computer program instructions.These program instructions may be provided to a processor to produce amachine, such that the instructions which execute on the processorcreate means for implementing the functions specified in the blocks. Thecomputer program instructions may be executed by a processor to cause aseries of operational steps to be performed by the processor to producea computer implemented process such that the instructions which executeon the processor provide steps for implementing the functions specifiedin the blocks. Accordingly, the illustrations support combinations ofmeans for performing a specified function and combinations of steps forperforming the specified functions. It will also be understood that eachblock and combination of blocks can be implemented by special purposehardware-based systems which perform the specified functions or steps,or combinations of special purpose hardware and computer instructions.

Thus, in accordance with the invention there is provided a new andeffective way of analyzing collected performance and flow informationfor large networks, allowing a user to understand what's happening on anetwork.

1. A system for visually representing performance and flow analysis of acommunication network having devices connected by one or more links,comprising: a first memory for storing a graphical representation of thecommunication network and showing the devices connected by the one ormore links; a second memory storing data representing performance andflows in the communication network; a third memory storing a pluralityof symbols representing different devices and a plurality of edgesrepresenting links, wherein the processing system selectively maps thedata on the graphical representation using the symbols and the edges; adisplay; and a processing system operatively connected to the first andthe second memory and to the display, the processing system selectivelymapping the data on the graphical representation of the communicationnetwork by varying visual characteristics of the devices and the one ormore links for viewing on the display, said visual characteristicsrepresenting performance and flows of the devices and the one or morelinks, said visual characteristics for each of the one or more linksshowing performance and flows for each direction between the devicesconnected by the link in the communication network wherein the edgescomprise bidirectional arrows for oriented metrics, and wherein to varyvisual characteristics of the bidirectional arrows, the processingsystem varies thicknesses of the arrows and a contact point between thearrows according to relative metric values in both flow directions. 2.The system of claim 1 wherein the second memory comprises a database ofmetric values for the devices and the links taken at select times. 3.The system of claim 2 further comprising a data collection system forcollecting data from the devices and the links at the select times tobuild the database.
 4. The system of claim 1 wherein the processingsystem selectively maps the data on the graphical representation of thecommunication network by varying size of the devices and the links forviewing on the display responsive to variation in performance and theflows in the communication network.
 5. The system of claim 1 wherein theprocessing system selectively maps the data on the graphicalrepresentation of the communication network by varying color of thedevices and the links for viewing on the display responsive to variationin performance and the flows in the communication network.
 6. The systemof claim 1 wherein the data comprises metrics of a plurality ofperformance and flow characteristics and the processing system mapsselect ones of the metrics responsive to selection of a desired view ofthe communication network.
 7. The system of claim 1 wherein theprocessing system varies visual characteristics of the symbols and theedges responsive to variation in performance and flows in thecommunication network to build a graphical display.
 8. The system ofclaim 7, wherein the processing system varies sizes or colors of thesymbols and the edges.
 9. A method for visually representing performanceand flow analysis of a communication network having devices connected bylinks, comprising: storing in a memory a graphical representation of thecommunication network and showing the devices connected by the one ormore links; storing in a memory data representing performance and flowsin the communication network; storing in a memory a graphicalrepresentation comprises storing a plurality of symbols representingdifferent devices and a plurality of edges representing links, andwherein selectively mapping comprises building the graphical displayusing the symbols and the edges; selectively mapping the data on thegraphical representation of the communication network by varying visualcharacteristics of the devices and the one or more links to build agraphical display, said visual characteristics representing performanceand flows of the devices and the one or more links, said visualcharacteristics for each of the one or more links showing performanceand flows for each direction between the devices connected by the linkin the communication network wherein the edges comprise bidirectionalarrows for oriented metrics, and wherein varying visual characteristicsof the bidirectional arrows comprises varying thickness of the arrowsand location of a contact point between the arrows; and according torelative metric values in both flow directions. displaying the graphicaldisplay on a video display device.
 10. The method of claim 9 furthercollecting data from the devices and the links at select times to builda database.
 11. The method of claim 9 wherein selectively mapping thedata comprises mapping the data on the graphical representation of thecommunication network by varying size of the devices and the links forviewing on the display device responsive to variation in performance andflows in the communication network.
 12. The method of claim 9 whereinselectively mapping the data comprises mapping the data on the graphicalrepresentation of the communication network by varying color of thedevices and the links for viewing on the display device responsive tovariation in performance and flows in the communication network.
 13. Themethod of claim 9 wherein the data comprises metrics of a plurality ofperformance and flow characteristics in the communication network. 14.The method of claim 13 further comprising selecting a desired view ofthe performance and flows in the communication network, the desired viewbeing represented by select ones of the metrics.
 15. The method of claim13 wherein selectively mapping the data on the graphical representationof the communication network comprises setting a scale of the metricsusing minimum and maximum values of the metrics, the scales being usedto vary visual characteristics of the devices and the links.
 16. Themethod of claim 9, wherein selectively mapping comprises varying visualcharacteristics of the symbols and the edges responsive to variation inperformance and flows in the communication network to build a graphicaldisplay.
 17. The method of claim 16, wherein varying the visualcharacteristics comprises varying sizes or colors of the symbols and theedges.
 18. A system for visually representing performance and flowanalysis of a communication network having devices connected by one ormore links, comprising: a first memory storing a graphicalrepresentation of the communication network having the devices connectedby the one or more links; a second memory storing data representingperformance and flows in the communication network; a third memorystoring a plurality of symbols representing different devices and aplurality of edges representing links, wherein the processing systemselectively maps the data on the graphical representation using thesymbols and the edaes; a display; and a processing system operativelyconnected to the first and the second memory and to the display, theprocessing system selectively mapping the data on the graphicalrepresentation of the communication network by varying visualcharacteristics of the devices and the one or more links for viewing onthe display, said visual characteristics representing performance andflows of the devices and the one or more links, said visualcharacteristics for at least one of the links comprising a plurality oflayered lines, each of the layered lines representing a different metricwherein the edges comprise bidirectional arrows for oriented metrics,and wherein to vary visual characteristics of the bidirectional arrows,the processing system according to relative metric values in both flowdirections varies thicknesses of the arrows and a contact point betweenthe arrows.
 19. The system of claim 18, wherein the processing systemvaries color intensity or relative thickness of one or more of thelayered lines for viewing on the display responsive to variation inperformance and flows in the communication network.
 20. The system ofclaim 18, wherein each of the layered lines represents a differentmetric of a same type, and wherein the processing system shows thedifferent metrics of the same type in the layered lines for viewing onthe display.
 21. The system of claim 18, wherein the different metricscomprise a plurality of performance and flow characteristics, andwherein the processing system maps select ones of the different metricsresponsive to selection of a desired view of the communication network.22. A method for visually representing performance and flow analysis ofa communication network having devices connected by one or more links,comprising: storing in a memory a graphical representation of thecommunication network and showing the devices connected by the one ormore links; storing in a memory data representing performance and flowsin the communication network; storing in a memory a graphicalrepresentation comprises storing a plurality of symbols representingdifferent devices and a plurality of edges representing links, andwherein selectively mapping comprises building the graphical displayusing the symbols and the edges; selectively mapping the data on thegraphical representation of the communication network by varying visualcharacteristics of the devices and the one or more links to build agraphical display, said visual characteristics representing performanceand flows of the devices and the one or more links, said visualcharacteristics for at least one of the links comprising a plurality oflayered lines, each of the layered lines representing a different metricwherein the edges comprise bidirectional arrows for oriented metrics,and wherein varying visual characteristics of the bidirectional arrowscomprises varying thicknesses of the arrows and location of a contactpoint between the arrows according to relative metric values in bothflow directions; and displaying the graphical display on a video displaydevice.
 23. The method of claim 22 wherein varying said visualcharacteristics comprises varying color intensity or relative thicknessof one or more of the layered lines responsive to variation inperformance and flows in the communication network.
 24. The method ofclaim 22, wherein the different metrics are of a same type, and whereinvarying said visual characteristics comprises showing the differentmetrics of the same type in the layered lines for viewing on thedisplay.
 25. The method of claim 22, further comprising selecting adesired view of the performance and the flows in the communicationnetwork, the desired view being represented by select ones of themetrics.